Category Archives: security

SCAMMERS UP THEIR GAME

We’ve previously posted entries about telephone computer-support scammers (here, and here). That information is still relevant, and if you haven’t yet read these articles, you should.

Recently, these criminals have added a new weapon to their arsenal: Caller ID spoofing. In brief, the scammers use widely-available telemarketing hardware to make your phone’s caller ID feature report that their call is originating from Apple’s headquarters, when in fact it isn’t. Here is a MacRumors article about the new scam twist.

It bears repeating: Apple and Microsoft will not call you out of the blue to report that “you have a virus” or that “your computer needs repair.” Hang up on these callers, don’t even listen to their pitch. And, for heaven’s sake, don’t let them log into your computer remotely, and become a victim of ransomware or identity theft.

Anyone who initiates a call to you and then tries to charge you for emergency computer service is looking to bilk you—do not let them.

The One Ring

"I'd like to run some tests on that 'One Ring to rule them all' ring. Can I borrow it for a few days?" "I thought you had it?"

Know that sinking feeling you get in the pit of your stomach when you realize that something really important is nowhere to be found? That’s what we get every time we ask a client for the password to his Macintosh, and the answer comes back, “I don’t remember.”

No one knows better than we do how many passwords a modern computer user has to juggle in the course of a day. Your email; your Facebook account; your banks; your photo collection; your credit cards; your pharmacy; hundreds of websites; and perhaps even your home thermostat.

The Mac OS does a reasonably good job of keeping track of (almost) every password associated with your life, by storing them automatically in a secure storage area called your keychain. That way, it can guard them against loss, present them automatically whenever needed, and keep your online life as manageable as possible.

This keychain is secured by the one password that isn’t itself stored in the keychain: the password you use to login to your Macintosh. That makes your Mac password, in effect, the one password that rules them all. Given that password, you can automatically or manually look up any other password you own in that keychain. Without that password, your entire digital life is toast. Having this one password can mean the difference between having to pay for one or two hours of repair time, or many hours of repair time plus many hours of your own time.

“Can’t I just pick a new password?”

Sure you can. But if it were that straightforward, what would keep anyone who walked off with your computer from “picking a new password” for it, and thereby gaining access to every bank account and credit card you possess?

Yes, there’s a straightforward procedure to force a new password onto a Macintosh account. But when you next log into it, you’ll be notified that your keychain is inaccessible, because it’s still encrypted with your original password… which, of course, you still don’t know. With the old password, it would be a simple matter to unlock the keychain to encrypt it with the new password. Without it, every other password you need (and don’t remember on your own) is locked up forever.

Regular visits to the mental gymnasium

The one feature undoubtedly responsible for more cases of “I forgot my password” than any other is the automatic login. It’s seductive because it promises to make your daily online life easier, and does… until your disk drive fails, or you fall victim to a ransomware or tech support scam, and you need non-trivial reconstructive work done on your Mac. At that point, not knowing your password (because it’s been months or years since you actually had to type it anywhere) is an extra kick in the ribs that you really didn’t need while you were down. (We are seeing much the same syndrome now occurring among users of iPhones and iPads due to the availability of “Touch ID.” A password you never type is a password you soon forget.)

Our advice is never to enable automatic login. Computers get stolen; the kids and grandkids get into things they shouldn’t when nobody is around; and most importantly, typing in your password every time you log into your Mac is the best and most effective way to ensure you never forget it.

(If you’re currently running with automatic login enabled, and realize you have indeed forgotten your login password, contact us for help before doing anything else, including disabling automatic login. We can ensure that the contents of your keychain(s) are safe-stored for future accessibility before forcing your account to a new, known password.)

The Big Three passwords

Our advice to our clients is that they keep special track of three main passwords. With these passwords, you can recover most any other password you own. Just like you wouldn’t go for a drive without pocketing your license, you shouldn’t go online without having a record of these three passwords in a secure place.

  1. Your Mac login password, for all the reasons outlined above. This one will let you into your keychain, where most of the rest of your passwords are safe-stored.
  2. Your Apple ID (App Store / iTunes Store / iCloud) password. This password is a major special case, as it doesn’t exist in your keychain (unless you stored it there by hand as a note, which you may want to consider now that you know it’s possible). This is the password you need to reclaim all your purchased apps, tunes, and movies, and to reestablish connections with your iDevices.
  3. The password to your primary email address. If you forget or misplace either or both of the other two, this is the one you will need in order to receive responses to all the “reset my password” requests you will be making to all your secure websites (banks, etc.) as well as resetting your Apple ID password.

(If you’ve enabled iCloud Keychain, you also chose a six-digit iCloud Security Code which you may consider recording somewhere, as it won’t be in your Mac keychain—again, unless you put it there by hand. However, it’s not strictly necessary to have unless you’ve lost every other Apple device you own, as you can authorize any related activity from any of your Apple devices.)

Exercise records discipline

When we advise keeping copies of this information in a secure place, that also implies having a single place for the information, identifying which password is for what, and destroying obsolete versions of the passwords. As repair engineers, we are too often confronted with “records” consisting of multiple notebooks, index cards, and/or sticky notes containing several dozen total passwords, most of which have long since been superseded by others, with none of them identified as to account or function. To top it off, sometimes the working password is not even among them, having been recorded on an entirely separate piece of paper located elsewhere. A little organization and records discipline can mean the difference between a smooth service call and locking yourself out of your digital data indefinitely.

We hope you’ll consider the tips presented here and choose to adopt as many as possible in your own life, to keep your valuable data accessible to you while remaining secure from others.

 

DON’T CALL ME—I’LL CALL YOU

Write the following on the blackboard of your life, right underneath “There’s no such thing as a free lunch”:

Neither Microsoft nor Apple will ever phone you to fix your computer–at least not unless you have phoned them first.

Today, one of my senior clients got a call “from Microsoft.” Since she had been having problems with her DSL recently, she made the mistake of believing the caller. She complied with all his instructions and let him log into her Windows machine remotely, whereupon he showed her several screensful of “critical problems” that he said he would fix right away… as soon as she paid him $400 for the work.

“I don’t have that kind of money to throw around. You never said anything about a charge when you called me, and I’m not paying you anything.”

“You’d better pay me now, because if you hang up on me, you can’t call me back, I won’t call you back, and if I don’t get paid, you’ll never use Windows on your computer again.”

Refusing to be extorted, she hung up on him anyway, and then phoned me to see if there was anything I could do about her situation. When I showed up, I tried booting her system in Safe Mode, whereupon I was met with the demand, “This computer is configured to require a password in order to start up.” She had been victimized by a “ransomware” scammer.

A little time spent with a search engine revealed that my client had been saddled with a “SysKey password.” Establishing such a password encrypts a Windows data area called the”SAM registry hive,” so simply removing the password by force won’t fix this situation, and could result in the destruction of any number of other files. The same search showed many instances of other scammed users being victimized by this same exact trick.

I had to take the machine down to the shop, safestore the user files for insurance, then reset to a restore point from about a week ago. The backup process took longer than I would have liked, but my client was back to happily using her machine quicker than our scam caller could give his mother her next STD.

Unfortunately, these scams are on the rise. This is the second senior in my (admittedly small-town) client base who has been hit with a similar scam in the past quarter. The other was called by the fraudsters at Kavish, and had paid them $149, which (at my urging) she recovered by disputing the charge with her credit card company.

The lesson here is not to trust unknown callers who phone you with official-sounding requests, whether they say they are calling from Microsoft, your bank, a store, a law enforcement agency, or anywhere else. If you didn’t initiate the call and you don’t personally know the caller, treat him just as you would treat Peggy from Siberia: tell him nothing, and allow him no access to your stuff.

If you’ve called Microsoft, or Apple, or any other company for technical service, they will give you a ticket number. Write it down. When you receive a genuine return call, the caller will have that ticket number. If they don’t, hang up, and call the main number back.